Fix crash when hit-testing elements with -webkit-transform-style: preserve-3d
but no transform. We need to make localTransformState if we see preserve-3d.
Also need to call update3DTransformedDescendantStatus() before we test
m_has3DTransformedDescendant.

When we replace a bit of selected text with a string of the same length, we now send a selection change notification. The selection endpoints aren't changing their positions in the DOM or their offsets in the document, but they're probably changing visually (unless the text is fixed width), so it seems right to send the notification.

On the other hand, this happens during a setMarkedText call, which shouldn't even touch the selection. But that's a different (and known) bug.

Added a new RenderBoxModelObject::destroyLayer() call which is
now the only way which RenderLayers should ever be destroyed.
This ensures that the pointer to the layer is cleared in the
RenderObject after destruction, allowing us to ASSERT in the
RenderBoxModelObject destructor.

WebView/WebHTMLView.mm: (-[WebHTMLView doCommandBySelector:]):
If WebKit does not support the command, we need to pass the selector to super. In this case,
we'll consider the event not to be handled. This is not perfect because in theory, [super doCommandBySelector:]
can do some action that would cause WebKit to need to consider the event handled. But in practice, I've found no
example of that happening and causing broken behavior.

WebViewDidChangeSelectionNotifications weren't being sent for commands that change the selection's position
within the document without changing its position in the DOM. For example, pressing return in (caret marked by ):
<div contentEditable="true"><div>Hello</div></div>
Undo was being enabled, shouldDeleteDOMRange called, etc. when doing no-op deletes (a delete in an empty document
for example).

Changes to layout tests demonstrate fix.

editing/EditCommand.cpp:
(WebCore::EditCommand::apply): Don't call applyEditing for a TypingCommand. The TypingCommand knows whether or
not it did work that needs to be applied.

editing/Editor.cpp:
(WebCore::Editor::appliedEditing): Moved code (but did not alter) to changeSelectionAfterCommand.
(WebCore::Editor::unappliedEditing): Ditto.
(WebCore::Editor::reappliedEditing): Ditto.
(WebCore::Editor::changeSelectionAfterCommand): Moved code from *appliedEditing into here. Also call out to
EditorClient::respondToChangedSelection() for commands that changed the selection's position in the document
even if they did not change it's position in the DOM. Any TypingCommand that gets this far changed it's position
in the document.

editing/Editor.h:

editing/TypingCommand.cpp:
(WebCore::TypingCommand::TypingCommand): Removed unused m_appliedEditing.
(WebCore::TypingCommand::typingAddedToOpenCommand): Always apply editing. We won't get this far if we don't need to.
(WebCore::TypingCommand::deleteKeyPressed): Don't do any of the things that only make sense for Range selections, like
adding to the killring and responding to a change in selections if the delete was a no-op.
(WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.

Build fix for when ENABLE_NETSCAPE_PLUGIN_API = 0. The method
ScriptController::jsObjectForPluginElement(HTMLPlugInElement*); is not
protected by an #if and uses HTMLPlugInElement so it must be included.

The handling of MALLOC_ADMIN_REGION_RANGE_TYPE in FastMalloc's zone was incorrect. It was attempting
to record the memory containing and individual span as an administrative region, when all memory
allocated via MetaDataAlloc should in fact be recorded. This was causing memory regions allocated
via MetaDataAlloc to appear as "VM_ALLOCATE ?" in vmmap output. They are now correctly reported as
"MALLOC_OTHER" regions associated with the JavaScriptCore FastMalloc zone.

Memory is allocated via MetaDataAlloc from two locations: PageHeapAllocator, and TCMalloc_PageMap{2,3}.
These two cases are handled differently.

PageHeapAllocator is extended to keep a linked list of memory regions that it has allocated. The
first object in an allocated region contains the link to the previously allocated region. To record
the administrative regions of a PageHeapAllocator we can simply walk the linked list and record
each allocated region we encounter.

TCMalloc_PageMaps allocate memory via MetaDataAlloc to store each level of the radix tree. To record
the administrative regions of a TCMalloc_PageMap we walk the tree and record the storage used for nodes
at each position rather than the nodes themselves.

A small performance improvement is achieved by coalescing adjacent memory regions inside the PageMapMemoryUsageRecorder
so that fewer calls in to the range recorder are necessary. We further reduce the number of calls to the
range recorder by aggregating the in-use ranges of a given memory region into a local buffer before recording
them with a single call. A similar approach is also used by AdminRegionRecorder.

loader/mac/ResourceLoaderMac.mm:
(WebCore::ResourceLoader::willCacheResponse):
An identifier is only asssigned if resource load callbacks are done. So don't send
willCacheResponse which uses identifier if resource load callbacks aren't being sent.

<rdar://problem/6619630> Quick Look of vCards stuck on image of first card opened.

I narrowed this down to ​http://trac.webkit.org/changeset/39304 which, among other things,
consolidated some of the various decision making pieces of the Cache into the new method
FrameLoader::cachePolicy().

Before 39304, when deciding whether to use an existing CachedResource, we checked if the FrameLoader
is reloading. If it is, we'd evict any existing resource then recreate it. Quick looks uses the
same URL for this image every time and expects it to be reloaded with each new card.

The FrameLoader::isReloading() check did one thing - Ask the DocumentLoader if it's cache policy
is "ReloadIgnoringCacheData". This check was lost in the consolidation to the new method.

Make sure to factor clear deltas into y position estimates. Also avoid doing the comparison of
the final position against the y position estimate until after the clear has happened. This gets rid
of some duplicated cut/pasted code and also ensures a layout delta only has to be put in once.

Make all media layout tests log the condition that is being tested,
success or failure, plus observed value when a test condition fails
so it is possible to see exactly what failed without having to hack
the test source. Consolidate some of the logic in the shared JavaScript file.

Fix a regression that broke dirxml and caused an ASSERT in debug builds. Also simplified
the console code and refactored things to have fewer code paths and duplication.

Reviewed by Kevin McCullough.

Test: manual-tests/inspector/console-dir.html

bindings/js/JSInspectedObjectWrapper.cpp:
(WebCore::JSInspectedObjectWrapper::wrap): Use the lexicalGlobalObject instead of dynamicGlobalObject
to fix an ASSERT about using a wrapper from the wrong ExecState.

inspector/front-end/Console.js:
(WebInspector.Console.prototype._format): Remove the inline argument and add forceObjectFormat.
When forceObjectFormat is true, the only formatter used is _formatobject.
(WebInspector.Console.prototype._formatvalue): Remove the inline argument.
(WebInspector.Console.prototype._formatstring): Ditto.
(WebInspector.Console.prototype._formatregexp): Ditto.
(WebInspector.Console.prototype._formatarray): Ditto.
(WebInspector.Console.prototype._formatnode): Remove the inline argument and make a DOM tree instead of an anchor.
(WebInspector.Console.prototype._formatobject): Remove the inline argument and always make a property graph.
(WebInspector.Console.prototype._formaterror): Remove the inline argument.
(WebInspector.ConsoleMessage): Remove the case for MessageLevel.Node and
simplify the case for MessageLevel.Object to use the normal _format code path with the %O formatter.
(WebInspector.ConsoleMessage.prototype._format.formatForConsole): Don't pass an additional true argument for inline.
(WebInspector.ConsoleMessage.prototype._format.formatAsObjectForConsole): Added. Pass a true argument for forceObjectFormat.
(WebInspector.ConsoleMessage.prototype._format): Added support for the %O formatter. Use formatForConsole for all arguments.
(WebInspector.ConsoleMessage.prototype.toString): Add the other message levels.

inspector/front-end/inspector.css: Tweak styles to look and work correctly.

page/Console.cpp:
(WebCore::printMessageSourceAndLevelPrefix): Fix an assert by adding the other message level types.
(WebCore::Console::dirxml): Use the standard log fuction since it prints a DOM tree for nodes by default.

<rdar://problem/6616664> - Quick looks of various file types is broken

In ​http://trac.webkit.org/changeset/40553 there was an attempt to prevent NSURLRequest churn
for non-HTTP loads when the underlying ResourceRequest changed. Unfortunately it was a little
overzealous as the mainDocumentURL is relevant for all loads, not only HTTP/HTTPS loads.

Partially reverted behavior to always set the mainDocumentURL in situations when we would've
before that patch.

​http://bugs.webkit.org/show_bug.cgi?id=23482
Add the following CSS 2.1 tests, with YinYang character (U+262F)
and SouthEast Arrow (U+2798) replaced by png images,
to fast/block/float. Leftward white arrow (U+21E6) is also
replaced by an ASCII-equivalent of '<-'.

Maintain a bit on each RenderLayer that is set when the layer
has 3d descendants, so that we know when to fall into the slow
hit testing path.

Make a ref-counted HitTestingTransformState, which is used to store
an accumulated transform, and the hit test point, and hitTestRect
in the plane of the ancestor non-3d ('flattening') layer.

It's ref-counted so we can heap allocate it (to avoid stack bloat),
and avoid copying when hitTestLayer calls itself after applying the transform.

Add logic to hitTestLayer to depth-test just direct descendants, if any have
3D transforms, or to do deep depth-testing when traversing a preserves-3d
hierarchy. When hit, layers compute a z-offset from the ancestor flattening
layer, which allows for correct depth testing.

The existing early-return codepath is unaffected when there are no 3d transforms
and no preserve-3d.

03/02/09:

If RenderTextControlSingleLine::nodeAtPoint() pokes a node into the
HitTestResult, then it had better well return |true|. And m_innerBlock
could never have been set as the hit node by the superclass, because
the superclass knows nothing about m_innerBlock.

page/Geolocation.cpp:
(WebCore::Geolocation::Geolocation):
(WebCore::Geolocation::disconnectFrame): Remove call to setUsingGeolocation as the document
will not be alive at this point.
(WebCore::Geolocation::getCurrentPosition): Check if the embedding app allows geolocation and
return a PERMISSION_DENIED if not.
(WebCore::Geolocation::watchPosition): Ditto.
(WebCore::Geolocation::shouldAllowGeolocation): Perform request to embedding layer of whether
to allow geolocation and cache the result.

inspector/front-end/Console.js:
(WebInspector.Console.prototype._enterKeyPressed): Pass the exception
boolean to the ConsoleCommandResult constructor and don't pass level.
(WebInspector.Console.prototype._formatnode): Fix a className typo.
(WebInspector.Console.prototype._formaterror): Add an error-message
classed span around the message to show in red and remove the
console-message-url class from the link so it doesn't float right.
Instead enclose the link in parentheses and use displayNameForURL
to shorten the URL in the link.
(WebInspector.ConsoleMessage.prototype.toMessageElement): Simplify
how line numbers are shown since link underlining a string with
parentheses looks bad.
(WebInspector.ConsoleCommandResult): Take an exception boolean flag
instead of a level and get line and URL based on that flag.

Reviewed by Adam Roben and previously by Eric Seidel and Simon Fraser.

​https://bugs.webkit.org/show_bug.cgi?id=24227
Ensure that the checkForSolidColor() optimization is correctly triggered
for all cases of drawPattern. Currently, the optimization was not triggered
when the check had not been previously performed via a request for the
image's NativeImagePtr.

Implement the Qt version of the checkForSolidColor() method. Combined with
the bug fix this reduces the time it takes to draw a repeating background
of a 1x1 image from ~50msecs to ~0msecs on my machine.

bindings/js/JSQuarantinedObjectWrapper.cpp:
(WebCore::JSQuarantinedObjectWrapper::transferExceptionToExecState):
Fix the order in which the exception is set and cleared now that the
exception is stored in the shared GlobalData, not per ExecState.

inspector/front-end/Console.js:
(WebInspector.Console.prototype._enterKeyPressed): Add the command
message before evaluating the result. Associate the originating
command to the result, so if they are adjacent there is no divider.
(WebInspector.ConsoleCommand): No longer take a result.
(WebInspector.ConsoleCommand.prototype.toMessageElement): Result
code removed since it isn't used now.
(WebInspector.ConsoleCommandResult): Subclass ConsoleMessage.
(WebInspector.ConsoleCommandResult.prototype.toMessageElement):
Call the ConsoleMessage toMessageElement and add a style class.

inspector/front-end/inspector.css: Add a new style class for
adjacent results to hide the divider. Also tweak the position of
the disclosure triangle for objects to not use the left margin.

dom/Document.cpp:
(WebCore::Document::recalcStyle): Pause scheduled events during style
reclaculation. Changes to the zoom property result in scroll events
being generated during style recalc, and those events need to be
deferred until the render tree is consistent.

page/FrameView.cpp:
(WebCore::FrameView::layout): Changed to account for a case in which the
post-layout tasks trigger a nested layout, which reactivates the
post-layout task timer.

LayoutTests:

Reviewed by Darin Adler.

test for <rdar://problem/6634768> Reproducible crash in RenderLayer::updateScrollCornerStyle() using full-page zoom at MobileMe Contacts

Pass securityOrigin->host() instead of securityOrigin->domain() to WebInspector
when creating databases, localStorage or sessionStorage. Changing document.domain
should have no affect on databases, localStorage and sessionStorage in Web Inspector.